Security

Security

Scripture Pod is open source. Reading the code does not give anyone access to your running app: the secrets are made on each computer and are not in the code.

Links

• The Display, Monitor and Media links contain a secret token, made when the app starts (it changes at every launch). The connection that carries live content refuses anyone without it.
• Treat the links like passwords. Anyone who has a link and can reach this computer on the network can show a display. Do not post them publicly.
• The page files themselves load without the token, but they show nothing without the connection.
• A browser that opens the display address without being picked must be allowed in the app first, and then it can only connect to the display.
• Never expose ports 5510, 5511 or 8087 to the internet. Use the app on your own network.

Phone remote

Anyone with the remote link can control the service. It is off until you switch it on, so switch it off when you are done. With the service lock on, actions from the phone ask for confirmation on the computer.

Other Scripture Pod computers

Receive is off until you turn it on, the pairing code changes at every launch, and the other computer can only open this computer's own display page.

What the web server serves

Only the app's own folders, and it blocks ../ escapes. Media files you play are served under random IDs and need no token, so do not rely on them being hidden if the address is known.

Updates

The app opens only addresses on the project's GitHub, and downloads updates only from the project's GitHub releases.

Reporting a security problem

Please open a GitHub issue without including your links or tokens, or contact the maintainer directly.